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Rob Luke Deputy Commissioner (Policy) 
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Richard Marbrow Group Manager Corporate Governance 
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Secretariat 
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1. Introductions and apologies 


There were apologies from Elizabeth Denham who was unable to attend 
the meeting. 


2. Matters arising from the previous meeting 


Minutes 
The draft minutes of the previous meeting were agreed as being an 
accurate record and for proactive publication. 


Actions and decisions 
Outstanding actions were considered. In most cases the actions 
could be cleared. 


Action status was to be indicated in writing as well as colour. 


3. Terms of reference for MB, AC and SLT 


Issue 

The terms of reference for the Management Board, Audit Committee 
and Senior Leadership Team had been circulated to senior 
managers and the Non-executive Directors, and minor amendments 
had been made. The terms of reference were being brought to 


Senior Leadership Team for agreement prior to coming to 
Management Board for information. 


Decision 
The terms of reference were agreed subject to the following 
amendments: 

e references to Senior Management Team and the Corporate 
Plan were to be updated; 

e a decision was to be made as to whether or not the proposed 
General Counsel would be part of the Senior Leadership Team 
and Management Board; 

e Management Board membership was to be amended to allow 
for more than four Non-executive Directors; and 

e changes to para 2.1 of the Senior Leadership Team terms of 
reference. 


Actions 

Richard Marbrow to consult the Commissioner as to whether or not 
the General Counsel would be a member of the Senior Leadership 
Team and Management Board. 


Peter Bloomfield to amend the terms of reference and to send to 
Paul Arnold for a contribution on para 2.1 of the Senior Leadership 
Team terms, prior to bringing to Management Board on the 8 May. 


4. ICO certification strategy 


Issue 

This paper advised Senior Leadership Team that the Commissioner 
had agreed a refreshed approach to the delivery of certification 
through exploring the development of a privacy management 
accountability framework. 


Management Board was to be updated on 8 May and a more 
detailed paper outlining the project plan for the revised work stream 
would come to Senior Leadership Team on 15 May. 


Project ownership and the end date for the project needed to be 
clarified. There also needed to be internal and external 
communications on the matter. 


Actions 

Rob Luke to update Management Board on the changed approach 
on 8 May and to update Senior Leadership Team on the project to 
take forward the work-stream on 15 May. 


5. Management Board on 8 May 


Issue 
The agenda for the forthcoming Management Board was presented 
for agreement. 


There was discussion on the format of the Information Rights 
report. 


Actions 

Richard Marbrow to discuss with the Commissioner whether to use 
the usual Non-executive Director briefing slot as an opportunity for 
discussion between the Non-executive Directors and the 
Commissioner. 


Senior Leadership Team members to provide briefing to help inform 
the Commissioner’s update to the Board (item 4) by Wednesday 25 
April. 


Rob Luke to provide the Board with an update on additional ICO 
responsibilities (item 6). 


Peter Bloomfield to provide the Board with an update on the Annual 
Report and Accounts (under item 5). 


Peter Bloomfield to amend the agenda: 
Agenda item 7 was covered under agenda item 5. 
Under agenda item 9, the DCEO reports were to be listed 
individually. 


Peter Bloomfield to develop a possible format for future 
Management Board papers. 


6. Risk and opportunity management 


Issue 

A new format risk and opportunity register was being developed 
making use of recent guidance, and risks and opportunities were 
being updated. Work had also been done on articulating the |CO’s 
risk appetite; to help explain decisions which involved risk. 


Decision 

In respect of the risk and opportunities item for Management Board 
it was agreed that the new format would be used, but with current 
risks as there was not enough time to do a full scale review. 


The need for consultation with staff and managers on risks was 
agreed. 


The need for a read across between the Information Rights 
Strategic Plan and the risk appetite statement was noted. 


Actions 
Paul Arnold to update the risk appetite statement. 


Peter Bloomfield to include the risk appetite statement in the new 
format risk and opportunity register and to amend the risk and 
opportunities register for Management Board on 8 May. 


7. Any other business 
It was proposed that the strategic file tracker would come to Senior 


Leadership Team (informal meetings) once a month, starting on the 8 
May. 


